Unsupervised Anomaly Detection of Information Operations Users via Behavioral and Language Patterns

2026-07-07

AI Summary

This work addresses the limitations of existing approaches to detecting information operation (IO) accounts on social media, which struggle to adapt to evolving behaviors under supervised paradigms or rely on unrealistic assumptions of coordinated activity in unsupervised settings. To overcome these challenges, the study formulates IO user detection as an unsupervised anomaly detection problem and introduces TENSOR, a novel method that uniquely integrates users’ temporal behavioral patterns with textual linguistic features. TENSOR leverages temporal point processes to model anomalous dynamics and incorporates an evidence function derived from large language models to calibrate detection outcomes, thereby circumventing restrictive coordination assumptions. Extensive experiments across five real-world IO datasets demonstrate that TENSOR significantly outperforms current baselines, and the implementation has been made publicly available.

Abstract

Information Operations on social media networks have been identified as a significant threat to democracy and modern society, but they are challenging and expensive to detect by humans. Existing supervised IO detection methods fail to capture the dynamic nature of evolving IO user behavior, while existing unsupervised approaches rely on oversimplified assumptions of coordination among IO users that may not exist in practice. To overcome the limitations of existing methods, we formulate IO user detection as an anomaly detection problem and propose a novel unsupervised IO user detection approach called Temporal-bEhavior-laNguage Signals for information Operation Recognition (TENSOR), which leverages multimodal data, including temporal online user behavior, such as message posting activities, and the textual content of the messages. The motivation is that IO users are typically a very small fraction of all online users and have unique temporal behavioral and language patterns. Specifically, we train a Temporal Point Process (TPP) to capture abnormal temporal behavioral patterns of IO users because they are known to behave in a coordinated manner for IO campaigns. We further introduce a novel evidence function that converts LLM responses, which are generated from user post timelines, into quantitative scores to adjust the TPP outputs for better IO user detection. Experimental results show that TENSOR outperforms the baselines on five real-world IO datasets. Code is available at https://github.com/xiuzhenzhang/TENSOR.

Problem

• Information Operations
• Unsupervised Anomaly Detection
• Social Media
• User Behavior
• Language Patterns

Innovation

• Unsupervised Anomaly Detection
• Temporal Point Process
• Multimodal Behavioral Signals
• Large Language Models
• Information Operations